CVE-2016-2786 - Incorrect Client Verification in Puppet Communications Protocol

  • Posted March 14, 2016

  • Assessed Risk Level: High

The Puppet Communications Protocol included in Puppet Enterprise 2015.3 does not properly validate certificates in all cases. This potentially allows for arbitrary remote code execution on Puppet agent nodes.

In PE 2015.3.2 and earlier, the pxp-agent component does not properly validate the server certificate. This makes it possible for an attacker to impersonate a broker and issue commands to the agent, assuming the attacker can force the agent to connect to an arbitrary broker via a secondary attack (DNS spoofing, etc).

Default configurations of FOSS Puppet Agent are not vulnerable.


Affected Software Versions:

  • Puppet Enterprise 2015.3.x prior to 2015.3.3
  • Puppet Agent 1.3.x

Resolved in:

  • Puppet Enterprise 2015.3.3
  • Puppet Agent 1.3.6